Privacy Policy

1. Who we are

Housing Report Card (“Housing Report Card”, “we”, “us”, or “our”) is a service operated by Mhytee Luhring. Postal address: 1968 S. Coast Hwy #4415, Laguna Beach, CA 92651. For privacy questions, email support@housinggrade.com.

This policy describes what information we collect when you use the Housing Report Card website and alert service, how we use it, who we share it with, and the choices you have.

2. Information we collect

2.1 Information you provide

• Account email — when you sign in or subscribe to address monitoring.
• Phone number — optional, only if you opt into SMS alerts.
• Address-watch preferences — the San Francisco addresses you ask us to monitor and which record types (DBI complaints, notices, permits, Fire, 311) you want alerts on.
• Recently viewed addresses — when you are signed in, the addresses you view are saved to your account so the “Recently viewed” list follows you across devices. Each entry stores the address, neighborhood, grade, and the time you viewed it. The list is private to your account, protected by row-level security in our database, and is never shown publicly. You can remove individual entries or clear the entire list at any time from the “Recently viewed” menu; deletions are applied to both your local browser and the server. When you delete your account, this history is removed automatically. When you are signed out, the same list is kept only in your browser’s localStorage and never reaches our servers.
• Tenant privacy reports — if you voluntarily submit a privacy-device report for an address, we store a hashed form of your email (we do not store the plaintext email with the report), plus the device type, location type, and disclosure status. Raw reports are kept private; only aggregated counts are shown publicly.
• Support messages — the content of any email you send us.

2.2 Information collected automatically

• Authentication tokens — stored in your browser’s localStorage by Supabase Auth so you stay signed in. Cleared when you sign out.
• Server logs — standard request logs (IP address, timestamp, user agent) retained for operational and security purposes.
• Privacy-friendly usage analytics — we record a small set of in-product events (for example, when a page is viewed, a search is submitted, or a record is opened) so we can understand how the site is used and improve it. These events are stored in our own Supabase database, not sent to any third-party analytics service. We do not use advertising pixels and do not track you across other sites.
  • Each event carries a random per-tab session id (held in your browser's sessionStorage; cleared when you close the tab) and a random per-browser visitor id (held in localStorage) so we can tell whether the same browser is coming back. Neither id is your name, email, or any other personal detail.
  • If you are signed in, events also include your user id so we can connect a session to your account; if you sign in after browsing anonymously, your prior anonymous events from this browser are linked to your account at that point.
  • Your IP address is not stored alongside events. It is hashed with a salt that we rotate every day and then discarded, which lets us detect bots and abuse without keeping a record that could be tied back to you across days.
  • We keep raw events for 90 days, then aggregate them to daily counts and delete the originals. You can clear the visitor id at any time from your browser settings (clear localStorage for this site).

2.3 Payment information

Paid subscriptions are processed by Stripe, Inc. We never see or store your full card number. We receive a Stripe customer ID and a subscription status (active, past-due, canceled, etc.) so we know whether to keep your alerts running.

2.4 Public records

Housing Report Card surfaces records that are already public — they are published by the City and County of San Francisco (DataSF, the Department of Building Inspection, the Fire Department, and 311). We do not create these records; we retrieve them from the City’s public data sources, combine them, and present them. Nothing about the public-record data is personal information that you gave us.

3. How we use information

• To run the service: signing you in, building a report for the address you search, sending alert emails when new records appear, processing your subscription.
• To communicate with you about your account, your subscription, or changes to the service.
• To prevent abuse, diagnose bugs, and comply with legal obligations.

We do not sell or rent your personal information.

4. Who we share it with

We use a small set of service providers to run the platform. Each of them only receives what they need to do their job:

• Supabase — database, authentication, and edge-function hosting.
• Stripe — payment processing and subscription billing. See Stripe’s privacy notice.
• Resend — transactional email delivery (welcome and alert emails).

We disclose information when we are legally required to (for example, to comply with a subpoena) or when we reasonably believe disclosure is necessary to protect someone’s safety.

5. Cookies and local storage

We do not set first-party tracking cookies. We use your browser’s localStorage to keep you signed in between visits; this is a strictly-necessary function of the site. Stripe may set cookies on its own domain during checkout — that is governed by Stripe’s privacy notice, not ours.

If we add advertising or any cross-site tracking in the future, we will update this policy and ask for your consent before setting any non-essential cookies in regions that require it.

6. Retention

• Active account data is retained as long as your account is active.
• When you delete your account, we soft-delete your profile and cancel all active watches and subscriptions. After 30 days we hard-delete the profile and any associated watches, subject to limited exceptions (see below).
• We keep your Stripe customer record for our records and to comply with tax and accounting requirements.
• Server logs and notification-delivery records are retained for up to 12 months.

7. Your rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate information.
• Delete your account — sign in, open your account panel, and click “Delete my account”. We cancel your subscriptions immediately and hard-delete your profile and watch history after 30 days.
• Export your information — sign in, open your account panel, and click “Download my data” to receive a JSON file of your profile, watches, and notification history.
• Withdraw consent or object to processing.
• Complain to a data-protection authority.

The in-app buttons are the fastest way to exercise the delete and export rights. For any other request — access, correction, or objection — email support@housinggrade.com and we will respond within 45 days.

7.1 California residents (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect, the right to request deletion, the right to correct inaccurate information, and the right to opt out of the “sale” or “sharing” of your personal information. We do not sell or share your personal information for cross-context behavioral advertising. We do not discriminate against consumers who exercise their privacy rights.

8. Email alerts and unsubscribing

Every alert email contains a one-click unsubscribe link that cancels the underlying address watch and, if applicable, the Stripe subscription tied to it. You can also cancel from your account at any time.

9. Children

Housing Report Card is not directed to children under 13 and we do not knowingly collect personal information from children. If you believe a child has given us information, email support@housinggrade.com and we will delete it.

10. Security

We use industry-standard security practices, including HTTPS, Supabase row-level security, and signed HMAC tokens for unauthenticated unsubscribe links. No internet service is perfectly secure; if we learn of a breach that affects you, we will notify you as required by law.

11. Changes to this policy

We may update this policy. If we make material changes we will post the updated policy on this page and update the “Last updated” date. Continued use of the service after an update means you accept the revised policy.

12. Contact

Questions about this policy? Email support@housinggrade.com.
Postal: Mhytee Luhring, 1968 S. Coast Hwy #4415, Laguna Beach, CA 92651.